Documentation
¶
Index ¶
- Constants
- Variables
- func DockerCheckRCTags(ctx context.Context, repoRoot string) map[string][]string
- func DockerScan(ctx context.Context) error
- func GenerateFilteredImageTagMap(ctx context.Context, filter map[string][]string) (map[string][]string, error)
- func PushChartToOCI(ctx context.Context, rootFs billy.Filesystem, ...) error
- func Scan(ctx context.Context, primeRegistry string) error
- func Sync(ctx context.Context, primeURL, customPath string) error
- type CVEReport
- type ImageCVEResult
- type ImageResult
- type LintWarning
- type Report
- type SeverityCounts
Constants ¶
const ( // StagingURL of SUSE Staging registry StagingURL string = "stgregistry.suse.com/" // DockerURL of images DockerURL string = "docker.io/" )
Variables ¶
var LoadImageVersionList = config.LoadImageVersionList
Functions ¶
func DockerCheckRCTags ¶
DockerCheckRCTags checks for any images that have RC tags
func DockerScan ¶ added in v1.6.7
DockerScan lists the repository tags from the local assets/ folder, compares them against the corresponding Docker Hub repository tags, and reports any discrepancies. It returns an error if an image tag from the assets/ folder is not found on Docker Hub, or if a repository is not in the `rancher` namespace.
func GenerateFilteredImageTagMap ¶
func GenerateFilteredImageTagMap(ctx context.Context, filter map[string][]string) (map[string][]string, error)
GenerateFilteredImageTagMap returns a map of container images and their tags
func PushChartToOCI ¶ added in v1.9.9
func PushChartToOCI(ctx context.Context, rootFs billy.Filesystem, ociDNS, customPath, ociUser, ociPass string, debug, overwrite bool) error
PushChartToOCI reads release.yaml and pushes all listed chart versions to an OCI registry. It validates credentials, sets up an authenticated Helm registry client, then runs a two-phase check-and-push: pre-flight validation first, then push of only the new assets. Existing versions in the registry are skipped rather than overwritten.
Types ¶
type CVEReport ¶ added in v1.9.28
type CVEReport struct {
Chart string `json:"chart"`
Version string `json:"version"`
CVECounts SeverityCounts `json:"CVEs"`
Images []ImageCVEResult `json:"images"`
PreviousVersion string `json:"previousVersion,omitempty"`
Delta *SeverityCounts `json:"delta,omitempty"`
}
CVEReport is the top-level output of CheckChartCVEs.
func CheckChartCVEs ¶ added in v1.9.28
CheckChartCVEs scans every image used by chart/version with Trivy, and if a previous released version with the same major exists, scans it too and reports the CVE delta.
type ImageCVEResult ¶ added in v1.9.28
type ImageCVEResult struct {
Repository string `json:"repository"`
Tag string `json:"tag"`
CVECounts SeverityCounts `json:"CVEs"`
}
ImageCVEResult holds the CVE counts found for a single image:tag.
type ImageResult ¶ added in v1.9.26
type ImageResult struct {
Repository string `json:"repository"`
CurrentTag string `json:"currentTag"`
LatestAvailable string `json:"latestAvailable"`
NeedsUpdate bool `json:"needsUpdate"`
}
ImageResult holds the version-check result for one image.
type LintWarning ¶ added in v1.9.12
type LintWarning struct {
Asset string // path to the .tgz file
YAMLPath string // dot-notation path to the offending node, e.g. "httpHeaderInjectorWebhook.proxy.image"
Repository string // the repository value found
Tag string // the tag value found (empty string if missing/null)
Reason string // "orphan_repository" | "wrong_namespace"
}
LintWarning represents a violation of image block rules in a chart's values.yaml.
func LintImageTags ¶ added in v1.9.12
func LintImageTags(ctx context.Context, baseBranch, tgzOverride string) ([]LintWarning, error)
LintImageTags enforces three rules on every image block found in the values.yaml of each PR-changed .tgz asset:
- repository present + tag missing/empty/null → block (orphan_repository)
- repository present + tag valid + repository not rancher/* → block (wrong_namespace)
- repository present + tag valid + repository is rancher/* → pass
type Report ¶ added in v1.9.26
type Report struct {
Chart string `json:"chart"`
NeedsUpdate bool `json:"needsUpdate"`
Images []ImageResult `json:"images"`
MissingFromChart []string `json:"missingFromChart,omitempty"`
SkippedUnsupported []string `json:"skippedUnsupported,omitempty"`
}
Report is the top-level output of ValidateImageVersions.
func ValidateImageVersions ¶ added in v1.9.26
ValidateImageVersions checks whether the images listed in configPath are on their latest minor/patch version within the chart at <repoRoot>/charts/<chart>/<version>.
Source Files